diff --git a/flake.lock b/flake.lock
index 7f2e29b6..d191fc82 100644
--- a/flake.lock
+++ b/flake.lock
@@ -22,6 +22,53 @@
         "type": "github"
       }
     },
+    "blobs": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1604995301,
+        "narHash": "sha256-wcLzgLec6SGJA8fx1OEN1yV/Py5b+U5iyYpksUY/yLw=",
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "rev": "2cccdf1ca48316f2cfd1c9a0017e8de5a7156265",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "type": "gitlab"
+      }
+    },
+    "cdarknet-hosts": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1671575921,
+        "narHash": "sha256-A+6Rb6ZffrD/MUrTME11gSLlKDTpUT4mv3WvrTTOU90=",
+        "ref": "refs/heads/master",
+        "rev": "7944c58a8993941b612e8f8822c3073d5e46e774",
+        "revCount": 240,
+        "type": "git",
+        "url": "ssh://git@git.darmstadt.ccc.de/cdark.net/hosts.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://git@git.darmstadt.ccc.de/cdark.net/hosts.git"
+      }
+    },
+    "check-flake": {
+      "locked": {
+        "lastModified": 1662502605,
+        "narHash": "sha256-jAT55UhabAxLAVGanxjnNdzH2/oX2ZjLsL4i2jPIP+g=",
+        "owner": "srid",
+        "repo": "check-flake",
+        "rev": "48a17393ed4fcd523399d6602c283775b5127295",
+        "type": "github"
+      },
+      "original": {
+        "owner": "srid",
+        "repo": "check-flake",
+        "type": "github"
+      }
+    },
     "darwin": {
       "inputs": {
         "nixpkgs": [
@@ -45,6 +92,33 @@
         "type": "github"
       }
     },
+    "emanote": {
+      "inputs": {
+        "check-flake": "check-flake",
+        "flake-parts": [
+          "flake-parts"
+        ],
+        "flake-root": "flake-root",
+        "haskell-flake": "haskell-flake",
+        "nixpkgs": [
+          "nixos-unstable"
+        ],
+        "treefmt-nix": "treefmt-nix"
+      },
+      "locked": {
+        "lastModified": 1675106498,
+        "narHash": "sha256-vqstWyXjaMER9LgRiwW4Dog0PoFMRZ2WIwRfxPEsaEA=",
+        "owner": "srid",
+        "repo": "emanote",
+        "rev": "66dad06ca8fff73e30c52aee28f6458c73c900e3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "srid",
+        "repo": "emanote",
+        "type": "github"
+      }
+    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -80,6 +154,21 @@
         "type": "indirect"
       }
     },
+    "flake-root": {
+      "locked": {
+        "lastModified": 1671378805,
+        "narHash": "sha256-yqGxyzMN2GuppwG3dTWD1oiKxi+jGYP7D1qUSc5vKhI=",
+        "owner": "srid",
+        "repo": "flake-root",
+        "rev": "dc7ba6166e478804a9da6881aa48c45d300075cf",
+        "type": "github"
+      },
+      "original": {
+        "owner": "srid",
+        "repo": "flake-root",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "locked": {
         "lastModified": 1667395993,
@@ -98,7 +187,7 @@
     "gitignore": {
       "inputs": {
         "nixpkgs": [
-          "pre-commit-hooks-nix",
+          "pre-commit-hooks",
           "nixpkgs"
         ]
       },
@@ -116,6 +205,21 @@
         "type": "github"
       }
     },
+    "haskell-flake": {
+      "locked": {
+        "lastModified": 1674066917,
+        "narHash": "sha256-nRSAb7N64zmAbXUoVVqY/s2LbSIdDTdfN0sSKG5/CCY=",
+        "owner": "srid",
+        "repo": "haskell-flake",
+        "rev": "c6ff897db9abdd4e5ff7911b5f9234a1380c6611",
+        "type": "github"
+      },
+      "original": {
+        "owner": "srid",
+        "repo": "haskell-flake",
+        "type": "github"
+      }
+    },
     "hexa-nur-packages": {
       "inputs": {
         "nixpkgs": [
@@ -142,7 +246,7 @@
           "nixos-unstable"
         ],
         "utils": [
-          "pre-commit-hooks-nix",
+          "pre-commit-hooks",
           "flake-utils"
         ]
       },
@@ -160,6 +264,54 @@
         "type": "indirect"
       }
     },
+    "nix-output-monitor": {
+      "inputs": {
+        "flake-compat": [
+          "pre-commit-hooks",
+          "flake-compat"
+        ],
+        "flake-utils": [
+          "pre-commit-hooks",
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "nixos-unstable"
+        ],
+        "pre-commit-hooks": [
+          "pre-commit-hooks"
+        ]
+      },
+      "locked": {
+        "lastModified": 1672353191,
+        "narHash": "sha256-e9OwOsD2lfJ8WfcIEcGU6tY9LWB2VGnKDEC4ZKfKJVc=",
+        "ref": "main",
+        "rev": "9345278323e8763ca04ede5429c72655c4cef0bf",
+        "revCount": 400,
+        "type": "git",
+        "url": "ssh://git@hera.m-0.eu/nix-output-monitor"
+      },
+      "original": {
+        "ref": "main",
+        "type": "git",
+        "url": "ssh://git@hera.m-0.eu/nix-output-monitor"
+      }
+    },
+    "nixdark": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1622585364,
+        "narHash": "sha256-XcPtucllbbB9p9HGkvKbaP5ep1pJ1FCFlb8cXmyIkMg=",
+        "ref": "refs/heads/master",
+        "rev": "4003f84e73e65ec3ee96803eae3b7015c4a13b4f",
+        "revCount": 14,
+        "type": "git",
+        "url": "ssh://git@git.darmstadt.ccc.de/cdark.net/nixdark.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://git@git.darmstadt.ccc.de/cdark.net/nixdark.git"
+      }
+    },
     "nixos-hardware": {
       "locked": {
         "lastModified": 1674550793,
@@ -174,6 +326,38 @@
         "type": "indirect"
       }
     },
+    "nixos-mailserver": {
+      "inputs": {
+        "blobs": "blobs",
+        "flake-compat": [
+          "pre-commit-hooks",
+          "flake-compat"
+        ],
+        "nixpkgs": [
+          "nixos-unstable"
+        ],
+        "nixpkgs-22_11": [
+          "nixos-stable"
+        ],
+        "utils": [
+          "pre-commit-hooks",
+          "flake-utils"
+        ]
+      },
+      "locked": {
+        "lastModified": 1671738303,
+        "narHash": "sha256-PRgqtaWf2kMSYqVmcnmhTh+UsC0RmvXRTr+EOw5VZUA=",
+        "ref": "refs/heads/master",
+        "rev": "6d0d9fb966cc565a3df74d3b686f924c7615118c",
+        "revCount": 544,
+        "type": "git",
+        "url": "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver.git"
+      }
+    },
     "nixos-stable": {
       "locked": {
         "lastModified": 1675327819,
@@ -204,7 +388,7 @@
         "type": "indirect"
       }
     },
-    "pre-commit-hooks-nix": {
+    "pre-commit-hooks": {
       "inputs": {
         "flake-compat": "flake-compat",
         "flake-utils": "flake-utils",
@@ -232,32 +416,37 @@
     },
     "root": {
       "inputs": {
+        "emanote": "emanote",
         "flake-parts": "flake-parts",
         "hexa-nur-packages": "hexa-nur-packages",
         "home-manager": "home-manager",
+        "nix-output-monitor": "nix-output-monitor",
         "nixos-hardware": "nixos-hardware",
+        "nixos-mailserver": "nixos-mailserver",
         "nixos-stable": "nixos-stable",
         "nixos-unstable": "nixos-unstable",
         "nixpkgs": [
           "nixos-unstable"
         ],
-        "pre-commit-hooks-nix": "pre-commit-hooks-nix",
+        "pre-commit-hooks": "pre-commit-hooks",
         "secrets": "secrets"
       }
     },
     "secrets": {
       "inputs": {
         "agenix": "agenix",
+        "cdarknet-hosts": "cdarknet-hosts",
+        "nixdark": "nixdark",
         "nixpkgs": [
           "nixos-unstable"
         ]
       },
       "locked": {
-        "lastModified": 1675313356,
-        "narHash": "sha256-3LkUMhFfB8A+2kfS5HE5Gs3+KuU+pYXw3WbNyYW8k24=",
+        "lastModified": 1675470417,
+        "narHash": "sha256-4B+3GzKF7CydZHTGpwr/CL0SnYjdUrneBBOhG41kuWc=",
         "ref": "refs/heads/main",
-        "rev": "a2b507c00439a75e10b314018ff1e74c7f06f514",
-        "revCount": 175,
+        "rev": "d9922f315041dfee8c0955975feab2bb8855ad61",
+        "revCount": 181,
         "type": "git",
         "url": "ssh://git@hera.m-0.eu/config-secrets"
       },
@@ -265,6 +454,21 @@
         "type": "git",
         "url": "ssh://git@hera.m-0.eu/config-secrets"
       }
+    },
+    "treefmt-nix": {
+      "locked": {
+        "lastModified": 1671882555,
+        "narHash": "sha256-43HxY5gNaDMkKckeEXbhua4Ay1/S1HnYzqZBIVhzeqI=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "97981314ddf673803a1d5f966014f444a1054b1e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index 0b987beb..401b991a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -9,14 +9,39 @@
       url = "git+ssh://git@hera.m-0.eu/config-secrets";
       inputs.nixpkgs.follows = "nixos-unstable";
     };
+    emanote = {
+      url = "github:srid/emanote";
+      inputs = {
+        flake-parts.follows = "flake-parts";
+        nixpkgs.follows = "nixos-unstable";
+      };
+    };
+    nix-output-monitor = {
+      inputs = {
+        flake-compat.follows = "pre-commit-hooks/flake-compat";
+        flake-utils.follows = "pre-commit-hooks/flake-utils";
+        nixpkgs.follows = "nixos-unstable";
+        pre-commit-hooks.follows = "pre-commit-hooks";
+      };
+      url = "git+ssh://git@hera.m-0.eu/nix-output-monitor?ref=main";
+    };
     nixos-unstable.url = "nixpkgs/nixos-unstable";
+    nixos-mailserver = {
+      inputs = {
+        flake-compat.follows = "pre-commit-hooks/flake-compat";
+        utils.follows = "pre-commit-hooks/flake-utils";
+        nixpkgs.follows = "nixos-unstable";
+        nixpkgs-22_11.follows = "nixos-stable";
+      };
+      url = "git+https://gitlab.com/simple-nixos-mailserver/nixos-mailserver.git";
+    };
     nixos-stable.url = "nixpkgs/nixos-22.11";
     nixpkgs.follows = "nixos-unstable";
     flake-parts.inputs.nixpkgs-lib.follows = "nixos-unstable";
     home-manager = {
       url = "home-manager/release-22.11";
       inputs = {
-        utils.follows = "pre-commit-hooks-nix/flake-utils";
+        utils.follows = "pre-commit-hooks/flake-utils";
         nixpkgs.follows = "nixos-unstable";
       };
     };
@@ -24,7 +49,7 @@
       url = "github:mweinelt/nur-packages";
       inputs.nixpkgs.follows = "nixos-unstable";
     };
-    pre-commit-hooks-nix = {
+    pre-commit-hooks = {
       url = "github:cachix/pre-commit-hooks.nix";
       inputs = {
         nixpkgs-stable.follows = "nixos-stable";
@@ -36,7 +61,7 @@
   outputs = inputs @ {nixos-hardware, ...}:
     inputs.flake-parts.lib.mkFlake {inherit inputs;} {
       imports = [
-        inputs.pre-commit-hooks-nix.flakeModule
+        inputs.pre-commit-hooks.flakeModule
         ./nixos/configurations.nix
         ./home-manager/modes.nix
         ./packages
diff --git a/home-manager/modes.nix b/home-manager/modes.nix
index 45d8191b..3c3b1aa4 100644
--- a/home-manager/modes.nix
+++ b/home-manager/modes.nix
@@ -23,6 +23,7 @@
       modules = [
         config
         inputs.self.nixosModules.insertOverlays
+        inputs.emanote.homeManagerModule
       ];
     });
     buildModesForHost = host: modes:
diff --git a/home-manager/roles/zettelkasten.nix b/home-manager/roles/zettelkasten.nix
index 3ab6c6c5..56a0aabf 100644
--- a/home-manager/roles/zettelkasten.nix
+++ b/home-manager/roles/zettelkasten.nix
@@ -2,11 +2,7 @@
   config,
   pkgs,
   ...
-}: let
-  emanote_commit = (builtins.fromJSON (builtins.readFile ../../nix/sources.json)).emanote.rev;
-  emanote = builtins.getFlake "github:srid/emanote/${emanote_commit}";
-in {
-  imports = [emanote.homeManagerModule];
+}: {
   services.emanote = {
     enable = true;
     # host = "127.0.0.1"; # default listen address is 127.0.0.1
diff --git a/home-manager/target.nix b/home-manager/target.nix
deleted file mode 100644
index 3d22afbe..00000000
--- a/home-manager/target.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-let
-  sources = import ../nix/sources.nix;
-  inherit (import sources.nixos-unstable {}) lib pkgs;
-  modes = import ./machines.nix;
-  home-manager = channel: import "${sources."${channel}"}/home-manager/home-manager.nix";
-  buildHomeManager = host: mode:
-    (home-manager (import ../channels.nix)."${host}".home-manager-channel {
-      confPath = ../home.nix;
-      confAttr = "${host}-${mode}";
-    })
-    .activationPackage;
-  buildModesForHost = host: modes:
-    pkgs.runCommandLocal "${host}-modes" {} ''
-      mkdir $out
-      ${lib.concatStringsSep "\n" (lib.mapAttrsToList (mode: config: "ln -s ${buildHomeManager host mode} $out/${mode}") modes)}'';
-in
-  lib.mapAttrs buildModesForHost modes
diff --git a/nix/sources.json b/nix/sources.json
deleted file mode 100644
index 3c21f929..00000000
--- a/nix/sources.json
+++ /dev/null
@@ -1,86 +0,0 @@
-{
-    "emanote": {
-        "branch": "master",
-        "description": "Spiritual successor to neuron, based on Ema.",
-        "homepage": "https://emanote.srid.ca",
-        "owner": "srid",
-        "repo": "emanote",
-        "rev": "66dad06ca8fff73e30c52aee28f6458c73c900e3",
-        "sha256": "0h385kqw8pq44fb9siach4z3920fp02qn4dqyh8w2s734mdjvaxy",
-        "type": "tarball",
-        "url": "https://github.com/srid/emanote/archive/66dad06ca8fff73e30c52aee28f6458c73c900e3.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "hexa-nur-packages": {
-        "branch": "master",
-        "description": "My personal NUR repository: [maintainer=@mweinelt] ",
-        "homepage": "",
-        "owner": "mweinelt",
-        "repo": "nur-packages",
-        "rev": "9232c47b4fcb481889cb3ecf131e8ee6dfa5e91a",
-        "sha256": "0l1i4r6gm6wzv6njipycq0d1yv2pcknlpb3ryx95pc2jivjqpfv3",
-        "type": "tarball",
-        "url": "https://github.com/mweinelt/nur-packages/archive/9232c47b4fcb481889cb3ecf131e8ee6dfa5e91a.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "home-manager-stable": {
-        "branch": "release-22.11",
-        "description": "Manage a user environment using Nix",
-        "homepage": "",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "65c47ced082e3353113614f77b1bc18822dc731f",
-        "sha256": "1fw01zfankc80rna9ch65p7bpg6fwcnvc0pmwvkpfazb7xq92108",
-        "type": "tarball",
-        "url": "https://github.com/nix-community/home-manager/archive/65c47ced082e3353113614f77b1bc18822dc731f.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "nix-output-monitor": {
-        "branch": "main",
-        "repo": "git@hera.m-0.eu:nix-output-monitor",
-        "rev": "9345278323e8763ca04ede5429c72655c4cef0bf",
-        "type": "git"
-    },
-    "nixos-hardware": {
-        "branch": "master",
-        "description": "A collection of NixOS modules covering hardware quirks.",
-        "homepage": "",
-        "owner": "nixos",
-        "repo": "nixos-hardware",
-        "rev": "b7ac0a56029e4f9e6743b9993037a5aaafd57103",
-        "sha256": "0yaw8q5kj34wnb1hzm0zchb43vnqn1llx5karmdx1hhrahh6acln",
-        "type": "tarball",
-        "url": "https://github.com/nixos/nixos-hardware/archive/b7ac0a56029e4f9e6743b9993037a5aaafd57103.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "nixos-mailserver": {
-        "branch": "nixos-22.11",
-        "repo": "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver",
-        "rev": "bc667fb6afc45f6cc2d118ab77658faf2227cffd",
-        "type": "git"
-    },
-    "nixos-stable": {
-        "branch": "nixos-22.11",
-        "description": "Nixpkgs/NixOS branches that track the Nixpkgs/NixOS channels",
-        "homepage": null,
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "285b3ff0660640575186a4086e1f8dc0df2874b5",
-        "sha256": "0sks32bifnga45sadsfq34qha4hs1rc21kgjp7bm2sw4zk9530b2",
-        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/285b3ff0660640575186a4086e1f8dc0df2874b5.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "nixos-unstable": {
-        "branch": "nixos-unstable",
-        "description": "Nixpkgs/NixOS branches that track the Nixpkgs/NixOS channels",
-        "homepage": null,
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "e1e1b192c1a5aab2960bf0a0bd53a2e8124fa18e",
-        "sha256": "1n1c8r4l4d9j7avvnmd8cy9m5x39fnss6jdvkwlwj39i00v2rbv6",
-        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/e1e1b192c1a5aab2960bf0a0bd53a2e8124fa18e.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    }
-}
diff --git a/nix/sources.nix b/nix/sources.nix
deleted file mode 100644
index 124d0f15..00000000
--- a/nix/sources.nix
+++ /dev/null
@@ -1,227 +0,0 @@
-# This file has been generated by Niv.
-let
-  #
-  # The fetchers. fetch_<type> fetches specs of type <type>.
-  #
-  fetch_file = pkgs: name: spec: let
-    name' = sanitizeName name + "-src";
-  in
-    if spec.builtin or true
-    then
-      builtins_fetchurl {
-        inherit (spec) url sha256;
-        name = name';
-      }
-    else
-      pkgs.fetchurl {
-        inherit (spec) url sha256;
-        name = name';
-      };
-
-  fetch_tarball = pkgs: name: spec: let
-    name' = sanitizeName name + "-src";
-  in
-    if spec.builtin or true
-    then
-      builtins_fetchTarball {
-        name = name';
-        inherit (spec) url sha256;
-      }
-    else
-      pkgs.fetchzip {
-        name = name';
-        inherit (spec) url sha256;
-      };
-
-  fetch_git = name: spec: let
-    ref =
-      spec.ref
-      or (
-        if spec ? branch
-        then "refs/heads/${spec.branch}"
-        else if spec ? tag
-        then "refs/tags/${spec.tag}"
-        else abort "In git source '${name}': Please specify `ref`, `tag` or `branch`!"
-      );
-  in
-    builtins.fetchGit {
-      url = spec.repo;
-      inherit (spec) rev;
-      inherit ref;
-    };
-
-  fetch_local = spec: spec.path;
-
-  fetch_builtin-tarball = name:
-    throw
-    ''      [${name}] The niv type "builtin-tarball" is deprecated. You should instead use `builtin = true`.
-              $ niv modify ${name} -a type=tarball -a builtin=true'';
-
-  fetch_builtin-url = name:
-    throw
-    ''      [${name}] The niv type "builtin-url" will soon be deprecated. You should instead use `builtin = true`.
-              $ niv modify ${name} -a type=file -a builtin=true'';
-
-  #
-  # Various helpers
-  #
-
-  # https://github.com/NixOS/nixpkgs/pull/83241/files#diff-c6f540a4f3bfa4b0e8b6bafd4cd54e8bR695
-  sanitizeName = name: (
-    concatMapStrings (s:
-      if builtins.isList s
-      then "-"
-      else s)
-    (
-      builtins.split "[^[:alnum:]+._?=-]+"
-      ((x: builtins.elemAt (builtins.match "\\.*(.*)" x) 0) name)
-    )
-  );
-
-  # The set of packages used when specs are fetched using non-builtins.
-  mkPkgs = sources: system: let
-    sourcesNixpkgs =
-      import (builtins_fetchTarball {inherit (sources.nixpkgs) url sha256;}) {inherit system;};
-    hasNixpkgsPath = builtins.any (x: x.prefix == "nixpkgs") builtins.nixPath;
-    hasThisAsNixpkgsPath = <nixpkgs> == ./.;
-  in
-    if builtins.hasAttr "nixpkgs" sources
-    then sourcesNixpkgs
-    else if hasNixpkgsPath && !hasThisAsNixpkgsPath
-    then import <nixpkgs> {}
-    else
-      abort
-      ''
-        Please specify either <nixpkgs> (through -I or NIX_PATH=nixpkgs=...) or
-        add a package called "nixpkgs" to your sources.json.
-      '';
-
-  # The actual fetching function.
-  fetch = pkgs: name: spec:
-    if !builtins.hasAttr "type" spec
-    then abort "ERROR: niv spec ${name} does not have a 'type' attribute"
-    else if spec.type == "file"
-    then fetch_file pkgs name spec
-    else if spec.type == "tarball"
-    then fetch_tarball pkgs name spec
-    else if spec.type == "git"
-    then fetch_git name spec
-    else if spec.type == "local"
-    then fetch_local spec
-    else if spec.type == "builtin-tarball"
-    then fetch_builtin-tarball name
-    else if spec.type == "builtin-url"
-    then fetch_builtin-url name
-    else abort "ERROR: niv spec ${name} has unknown type ${builtins.toJSON spec.type}";
-
-  # If the environment variable NIV_OVERRIDE_${name} is set, then use
-  # the path directly as opposed to the fetched source.
-  replace = name: drv: let
-    saneName = stringAsChars (c:
-      if ((builtins.match "[a-zA-Z0-9]" c) == null)
-      then "_"
-      else c)
-    name;
-    ersatz = builtins.getEnv "NIV_OVERRIDE_${saneName}";
-  in
-    if ersatz == ""
-    then drv
-    else
-      # this turns the string into an actual Nix path (for both absolute and
-      # relative paths)
-      if builtins.substring 0 1 ersatz == "/"
-      then /. + ersatz
-      else /. + builtins.getEnv "PWD" + "/${ersatz}";
-
-  # Ports of functions for older nix versions
-
-  # a Nix version of mapAttrs if the built-in doesn't exist
-  mapAttrs =
-    builtins.mapAttrs
-    or (
-      f: set:
-        with builtins;
-          listToAttrs (map (attr: {
-            name = attr;
-            value = f attr set."${attr}";
-          }) (attrNames set))
-    );
-
-  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/lists.nix#L295
-  range = first: last:
-    if first > last
-    then []
-    else builtins.genList (n: first + n) (last - first + 1);
-
-  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L257
-  stringToCharacters = s: map (p: builtins.substring p 1 s) (range 0 (builtins.stringLength s - 1));
-
-  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L269
-  stringAsChars = f: s: concatStrings (map f (stringToCharacters s));
-  concatMapStrings = f: list: concatStrings (map f list);
-  concatStrings = builtins.concatStringsSep "";
-
-  # https://github.com/NixOS/nixpkgs/blob/8a9f58a375c401b96da862d969f66429def1d118/lib/attrsets.nix#L331
-  optionalAttrs = cond: as:
-    if cond
-    then as
-    else {};
-
-  # fetchTarball version that is compatible between all the versions of Nix
-  builtins_fetchTarball = {
-    url,
-    name ? null,
-    sha256,
-  } @ attrs: let
-    inherit (builtins) lessThan nixVersion fetchTarball;
-  in
-    if lessThan nixVersion "1.12"
-    then fetchTarball ({inherit url;} // (optionalAttrs (name != null) {inherit name;}))
-    else fetchTarball attrs;
-
-  # fetchurl version that is compatible between all the versions of Nix
-  builtins_fetchurl = {
-    url,
-    name ? null,
-    sha256,
-  } @ attrs: let
-    inherit (builtins) lessThan nixVersion fetchurl;
-  in
-    if lessThan nixVersion "1.12"
-    then fetchurl ({inherit url;} // (optionalAttrs (name != null) {inherit name;}))
-    else fetchurl attrs;
-
-  # Create the final "sources" from the config
-  mkSources = config:
-    mapAttrs
-    (
-      name: spec:
-        if builtins.hasAttr "outPath" spec
-        then
-          abort
-          "The values in sources.json should not have an 'outPath' attribute"
-        else spec // {outPath = replace name (fetch config.pkgs name spec);}
-    )
-    config.sources;
-
-  # The "config" used by the fetchers
-  mkConfig = {
-    sourcesFile ?
-      if builtins.pathExists ./sources.json
-      then ./sources.json
-      else null,
-    sources ?
-      if (sourcesFile == null)
-      then {}
-      else builtins.fromJSON (builtins.readFile sourcesFile),
-    system ? builtins.currentSystem,
-    pkgs ? mkPkgs sources system,
-  }: rec {
-    # The sources, i.e. the attribute set of spec name to spec
-    inherit sources;
-
-    # The "pkgs" (evaluated nixpkgs) to use for e.g. non-builtin fetchers
-    inherit pkgs;
-  };
-in
-  mkSources (mkConfig {}) // {__functor = _: settings: mkSources (mkConfig settings);}
diff --git a/nixos/configurations.nix b/nixos/configurations.nix
index 03b8414f..48861391 100644
--- a/nixos/configurations.nix
+++ b/nixos/configurations.nix
@@ -36,7 +36,7 @@
         imports =
           [
             (import (./. + "/machines/${name}/configuration.nix") inputs)
-            inputs.secrets.nixosModules.secrets
+            inputs.secrets.nixosModules.default
             inputs.self.nixosModules.insertOverlays
           ]
           ++ modules;
@@ -51,6 +51,7 @@
         [
           (_: _:
             {
+              nix-output-monitor = inputs'.nix-output-monitor.packages.default;
               unstable = inputs'.nixos-unstable.legacyPackages;
               unfree = import inputs.nixos-stable {
                 inherit system;
diff --git a/nixos/machines/apollo/configuration.nix b/nixos/machines/apollo/configuration.nix
index 32aadcdd..658e0b36 100644
--- a/nixos/machines/apollo/configuration.nix
+++ b/nixos/machines/apollo/configuration.nix
@@ -6,12 +6,11 @@ flake-inputs: {
 }: let
   wireguard = import ../../../common/wireguard.nix;
   inherit (config.m-0) hosts prefix;
-  inherit ((import ../../../nix/sources.nix)) nixos-hardware;
   inherit (import ../../../common/common.nix {inherit pkgs;}) syncthing;
-  vpn = flake-inputs.secrets.private.privateValue (_: _: {}) "vpn";
 in {
   imports = [
-    "${nixos-hardware}/lenovo/thinkpad/t480s"
+    (flake-inputs.secrets.lib.vpn "apollo")
+    "${flake-inputs.nixos-hardware}/lenovo/thinkpad/t480s"
     ./hardware-configuration.nix
     ../../roles
     ../../roles/fonts.nix
@@ -29,7 +28,6 @@ in {
         "/home/maralorn/git"
       ];
     })
-    (vpn "apollo")
   ];
   systemd.services.lenovo_fix.path = [pkgs.kmod];
 
diff --git a/nixos/machines/fluffy/configuration.nix b/nixos/machines/fluffy/configuration.nix
index 4ea47054..ac659d31 100644
--- a/nixos/machines/fluffy/configuration.nix
+++ b/nixos/machines/fluffy/configuration.nix
@@ -1,4 +1,4 @@
-_: {
+flake-inputs: {
   config,
   pkgs,
   lib,
@@ -8,7 +8,12 @@ _: {
   inherit (config.m-0) hosts;
   localAddress = "fdc0:1::2";
 in {
+  disabledModules = [
+    "services/home-automation/home-assistant.nix"
+  ];
+
   imports = [
+    "${flake-inputs.nixos-unstable}/nixos/modules/services/home-automation/home-assistant.nix"
     ./hardware-configuration.nix
     ../../roles
     ../../roles/admin.nix
diff --git a/nixos/machines/hera/configuration.nix b/nixos/machines/hera/configuration.nix
index 88656056..3bab3087 100644
--- a/nixos/machines/hera/configuration.nix
+++ b/nixos/machines/hera/configuration.nix
@@ -1,4 +1,4 @@
-_: {
+flake-inputs: {
   config,
   pkgs,
   lib,
@@ -9,6 +9,7 @@ _: {
   backupJobNames = map (name: "borgbackup-job-${name}") (lib.attrNames backupJobs);
 in {
   imports = [
+    flake-inputs.nixos-mailserver.nixosModules.default
     ./hardware-configuration.nix
     ../../roles
     ../../roles/standalone
diff --git a/nixos/machines/hera/mail.nix b/nixos/machines/hera/mail.nix
index 8d8c1d36..7be83a1d 100644
--- a/nixos/machines/hera/mail.nix
+++ b/nixos/machines/hera/mail.nix
@@ -15,8 +15,6 @@ in {
     }
   ];
 
-  imports = [../../roles "${(import ../../../nix/sources.nix).nixos-mailserver}"];
-
   services = {
     unbound.enable = true;
     prometheus.exporters = {
diff --git a/nixos/machines/zeus/configuration.nix b/nixos/machines/zeus/configuration.nix
index 0d84af81..0a2cb156 100644
--- a/nixos/machines/zeus/configuration.nix
+++ b/nixos/machines/zeus/configuration.nix
@@ -9,7 +9,7 @@ flake-inputs: {
   inherit (import ../../../common/common.nix {inherit pkgs;}) syncthing;
 in {
   imports = [
-    (flake-inputs.secrets.private.privateValue (_: _: {}) "vpn" "zeus")
+    (flake-inputs.secrets.lib.vpn "zeus")
     "${flake-inputs.nixos-hardware}/common/gpu/amd/sea-islands"
     ./hardware-configuration.nix
     ../../roles
diff --git a/nixos/roles/home-assistant/default.nix b/nixos/roles/home-assistant/default.nix
index ee7dfaa7..7b928345 100644
--- a/nixos/roles/home-assistant/default.nix
+++ b/nixos/roles/home-assistant/default.nix
@@ -64,17 +64,12 @@
     "kalliope_battery_level"
     "schlafzimmerfenster_battery"
   ];
-  inherit (import ../../../nix/sources.nix) nixos-unstable;
   homeAssistantDir = "/disk/persist/home-assistant";
 in {
-  disabledModules = [
-    "services/home-automation/home-assistant.nix"
-  ];
-
   imports = [
-    "${nixos-unstable}/nixos/modules/services/home-automation/home-assistant.nix"
     ./hexa-cards.nix
   ];
+
   systemd.tmpfiles.rules = [
     "d ${homeAssistantDir} - - - - -"
   ];
diff --git a/overlays/00-sources.nix b/overlays/00-sources.nix
deleted file mode 100644
index 34bb6fb6..00000000
--- a/overlays/00-sources.nix
+++ /dev/null
@@ -1,3 +0,0 @@
-self: super: {
-  sources = import ../nix/sources.nix;
-}
diff --git a/overlays/10-previews.nix b/overlays/10-previews.nix
index e762191a..115bc112 100644
--- a/overlays/10-previews.nix
+++ b/overlays/10-previews.nix
@@ -1,7 +1,4 @@
-self: super: let
-  sources = builtins.fromJSON (builtins.readFile ../nix/sources.json);
-  myFlake = name: (builtins.getFlake "git+ssh://git@hera.m-0.eu/${name}?rev=${sources.${name}.rev}&ref=main").packages.x86_64-linux;
-in {
+self: super: {
   unstableHaskellPackages = self.unstable.haskellPackages;
   unstableGhc = self.unstable.ghc;
   inherit
@@ -13,5 +10,4 @@ in {
     emanote
     helix
     ;
-  nix-output-monitor = (myFlake "nix-output-monitor").default;
 }
diff --git a/overlays/writeHaskellScript.nix b/overlays/writeHaskellScript.nix
index ed8d4dcc..7fb5cff1 100644
--- a/overlays/writeHaskellScript.nix
+++ b/overlays/writeHaskellScript.nix
@@ -92,35 +92,7 @@ in {
         (builtins.map toString (bins ++ [pkgs.coreutils pkgs.nix]))
       } :: [String])
 
-      getNivPath :: Text -> Text -> IO Text
-      getNivPath sources channel = do
-        let expression = [i|(import #{sources}/nix/sources.nix)."#{channel}"|] :: String
-        nix_build ["-Q", "-E", expression, "--no-out-link"] &> devNull
-        escaped <- nix_instantiate ["--eval" :: String, "-E", [i|toString #{expression}|]] |> captureTrim
-        pure . Text.dropAround ('"' ==) . decodeUtf8 . trim $ escaped
-
-      aNixPath :: Text -> Text -> Text -> IO [String]
-      aNixPath homeManagerChannel nixpkgsChannel path = concat <$> mapM getNivAssign
-          [("home-manager", homeManagerChannel),
-           ("nixpkgs", nixpkgsChannel),
-           ("nixos-unstable", "nixos-unstable")]
-        where
-         tag name str = ["-I", [i|#{name :: Text}=#{str :: Text}|]] :: [String]
-         getNivAssign (name, repo) = tag name <$> getNivPath path repo
-
-      buildSystemParams :: [String]
-      buildSystemParams = ["<nixpkgs/nixos>", "-A", "system"]
-
-      remoteBuildParams :: [String]
-      remoteBuildParams = ["--builders", "@/etc/nix/machines"]
-
       main :: IO ()
       ${code}
     '';
-  get-niv-path = pkgs.writeHaskellScript {name = "get-niv-path";} ''
-    main = do
-        [sources, channel] <- fmap toText <$> getArgs
-        path <- getNivPath sources channel
-        say path
-  '';
 }